This is an older version. The current version is 1.3.6. ORAS CLI 1.3.6 · Released:
Installer files 1.3.3
| Architecture | Type | Scope | File size | Download | SHA256 |
|---|---|---|---|---|---|
| 64-bit | ZIP → Portable | — | — | github.com | VirusTotal |
Link and SHA256 come from the Windows Package Manager community manifest. Compare the hash of the downloaded file before running it.
Release notes
ORAS CLI v1.3.3 is a maintenance release focused on security hardening, dependency updates, and a few user-facing improvements to `oras attach`.
## Highlights
🔒 **Security:** upgraded `oras-go` to **v2.6.2**, which addresses a tar-extraction path-traversal advisory ([GHSA-fxhp-mv3v-67qp](https://github.com/advisories/GHSA-fxhp-mv3v-67qp)) affecting hardlink entries during `pull`/extract.
✨ **`oras attach` gains `--config`** support, and `--annotation $config:*` values now flow through to the packed manifest.
🛡️ **Supply-chain hardening:** GitHub Actions are now pinned to commit SHAs, SBOMs are attached to release artifacts, and static security scanning (gosec) runs in CI.
🐛 Copy/mount fixes: no longer mounts when source and destination credentials differ, and falls back to blob upload when a cross-repo mount fails.
## ✨ Features
Add `--config` flag support for `oras attach` by @ogulcanaydogan in #2000
Pass `--annotation $config:*` through to `PackManifestOptions` for `attach` by @SAY-5 in #2037
Allow setting `org.opencontainers.image.title` in the annotation file by @rafaelgieschke in #1872
Add SBOMs to the release workflow by @bupd in #1940
## 🐛 Bug Fixes
`cp` should not mount when source and destination credentials differ by @wangxiaoxuan273 in #1903
Fall back to blob upload when cross-repo mount fails by @bupd in #1924
Redact password values from e2e test execution logs by @TerryHowe in #2042
Revert Alpine base image to fix multi-arch build by @bupd in #1933
Set `GOTOOLCHAIN=local` in `snapcraft.yaml` to prevent auto-download by @TerryHowe in #2012
Fix typo in `logEntrySeparator` const by @Ahmad-Faraj in #2087
## 🔒 Security
Bump `oras.land/oras-go/v2` to **2.6.2** (addresses GHSA-fxhp-mv3v-67qp) by @dependabot in #2105, #2106
Add static security scanning (gosec) to CI by @bupd in #1934; resolve gosec findings (G703, G117, G704) by @TerryHowe in #1985
Pin GitHub Actions to commit SHAs by @TerryHowe in #2016; pin to full version comments by @alliasgher in #2038
Add `golangci-lint` configuration with additional linters by @bupd in #1936
## 📖 Documentation
Add examples to the `logout` command help text by @ogulcanaydogan in #2079
Add multi-repository backup and restore proposal by @shizhMSFT in #1917
## 🧰 Maintenance
Upgrade to Go 1.25.7 by @TerryHowe / @adriansali in #1980, #1910
Migrate from unmaintained `gopkg.in/yaml.v3` to `go.yaml.in/yaml/v4` by @bupd in #1922
Add `goheader` (license headers) and `revive` linters, plus `gofmt`/`go modernize` passes
~110 dependency updates across Go modules, Docker base images, and GitHub Actions via Dependabot
## New Contributors
* @rafaelgieschke made their first contribution in #1872
* @ManishhDev made their first contribution in #1883
* @johnsonshi made their first contribution in #1889
* @vr-varad made their first contribution in #1898
* @adriansali made their first contribution in #1910
* @bupd made their first contribution in #1933
* @alliasgher made their first contribution in #2038
* @ogulcanaydogan made their first contribution in #2000
* @bimakw made their first contribution in #1950
* @SAY-5 made their first contribution in #2037
* @gaoflow made their first contribution in #2093
* @Ahmad-Faraj made their first contribution in #2087
**Full Changelog**: https://github.com/oras-project/oras/compare/v1.3.2...v1.3.3
